16e89d4615223052b58376f38751ece8d3a67ebdadc11ebf7937ab214840a49c

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c00e6b536f0ddb9236ec2c800aba1e11_JaffaCakes118.exe
Size

255KB
MD5

c00e6b536f0ddb9236ec2c800aba1e11
SHA1

71659837be1ca197c350f50d658603af2a45f5dd
SHA256

16e89d4615223052b58376f38751ece8d3a67ebdadc11ebf7937ab214840a49c
SHA512

7c208cdd02f736550442ee809f3311f7a379246ae480666cd9a03ddb13d1d1a77cb9502c04f284e01ceeff0524fa637eda4034d16e010d5591b6e04d50a0864b
SSDEEP

3072:ddgWJRDKLMdGrtM1exQt4t+CUFoEVt25Lj0BTVLF106g5nHc6YR68fdySggG:/JlKggah4t+HFRt2ZqVFm6kHvYzVySg7

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2936	Religious Drove.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	c00e6b536f0ddb9236ec2c800aba1e11_JaffaCakes118.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	c00e6b536f0ddb9236ec2c800aba1e11_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\HandyLogs.job	c00e6b536f0ddb9236ec2c800aba1e11_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c00e6b536f0ddb9236ec2c800aba1e11_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c00e6b536f0ddb9236ec2c800aba1e11_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c00e6b536f0ddb9236ec2c800aba1e11_JaffaCakes118.exe"
1⤵
- Maps connected drives based on registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1820

C:\Users\Admin\AppData\Roaming\Religious Drove\Religious Drove.exe
"C:\Users\Admin\AppData\Roaming\Religious Drove\Religious Drove.exe"
1⤵
- Executes dropped EXE
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Religious Drove\Religious Drove.exe

Filesize
64KB

MD5
dcde998eac2f6dbd7a916ccb763142a5

SHA1
1bfa7dcc93bfa92a71c0b67c5ada43cd49807ad0

SHA256
e91a0aa2601920c708f6561bb4024bd1c5a731845304ad3cd7feab17e9339cdc

SHA512
46943a62e3f26e12038d7e6a39d7ee33f907a5e09194494ddecfc6af4b2dd3de540d23ee15b7c0cbd62bcfe22c2a9d9f044d33864eb727299292ce73496949c0

Download Submit
memory/1820-1-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/1820-0-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1820-2-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/1820-4-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/1820-3-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1820-9-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/1820-5-0x0000000000230000-0x000000000025F000-memory.dmp

Filesize
188KB

Download
memory/1820-12-0x0000000000650000-0x0000000000677000-memory.dmp

Filesize
156KB

Download
memory/1820-16-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/1820-25-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download
memory/1820-28-0x0000000000190000-0x00000000001B9000-memory.dmp

Filesize
164KB

Download